Mandiant's in-depth report published last month on a prolific cyberespionage
team tied to the Chinese military was, in turn, used as a lure in other
targeted attacks -- by what appears to be different Chinese hacker groups.

The attacks, spotted by Seculert, used a phony version of the report as a lure
in a spearphishing attack against Japanese and Chinese journalists. The
targeted attack against the Japanese victims came with an interesting twist: a
"time bomb" element, according to Aviv Raff, CTO at Seculert.

Mandiant's report calls out the People's Liberation Army Unit 61398 as the APT1
group responsible for cyberspying against multiple industries.

The malware used in the attacks on Japanese journalists was programmed to
trigger during 8 a.m. and 7 p.m. only, according to Raff. Raff says aside from
the malware communicating with legitimate Japanese websites, it also came with
another command-and-control domain in memory, one that was registered to a free
dynamic DNS server and went to a Korea-based IP address.

During the programmed time frame, the malware would communicate with "the real
C2 server," he says, rather than the legit Japanese websites. It also would
then download additional malware.